home

Selection Tools.exe

Selection Tools

NOSIBAY

The application Selection Tools.exe by NOSIBAY has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Selection Tools’. This file is typically installed with the program Selection Tools by Nosibay which is a potentially unwanted software program.
Publisher:
NOSIBAY  (signed and verified)

Product:
Selection Tools

Version:
3.1.111

MD5:
d557956d1c4a7c0cc41a6823105920fb

SHA-1:
3f013384b096959a5f0a849694e19ebdcf69e7c9

SHA-256:
933bb81b3822daccae17a21fea2253fe131d94aa4026fc53b14c0d16767bbfa6

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/15/2024 3:55:05 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NOSIBAY (M)
16.4.11.20

File size:
3.9 MB (4,084,464 bytes)

Product version:
3.1.111

Copyright:
(c) Copyright, All reproduction and distribution rights reserved to Nosibay

Original file name:
Selection Tools.exe

File type:
Executable application (Win32 EXE)

Language:
French (France)

Common path:
C:\users\{user}\appdata\roaming\wtools\selection tools\selection tools.exe

Digital Signature
Signed by:
NOSIBAY

Authority:
thawte, Inc.

Valid from:
10/26/2015 1:00:00 AM

Valid to:
1/25/2017 12:59:59 AM

Subject:
CN=NOSIBAY, OU=Secure Application Development, O=NOSIBAY, L=PEROLS, S=Hérault, C=FR

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
5F167BED0657C4880A327813C55256A5

File PE Metadata
Compilation timestamp:
4/11/2016 3:48:43 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
98304:mRYXPghEjgMx8ELmrhogAKFJgn+L1E8LNlY5OVcxC:mVHrtO6lY5OVH

Entry address:
0x21999B

Entry point:
E8, B1, 21, 01, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 10, 88, 79, 00, E8, AF, 51, 00, 00, E8, CB, 00, 01, 00, 0F, B7, F0, 6A, 02, E8, 44, 21, 01, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, E2, E7, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
2.7 MB (2,809,856 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Selection Tools

Command:
"C:\users\{user}\appdata\roaming\wtools\selection tools\selection tools.exe" \winstartup


The file Selection Tools.exe has been discovered within the following program.

Selection Tools  by Nosibay
Selection Tools is a potentially unwanted program.
About 63% of users remove it
 
Powered by Should I Remove It?

Remove Selection Tools.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.